Sony Network Communications breach exposes 2.5 million customer records

On 27 October 2026, Sony Network Communications announced that an unauthorised third party had accessed the member database of So-net, its internet access service. The company is a subsidiary of Sony Group Corporation and provides internet access in Japan. Bleeping Computer reported the announcement on 28 October. According to that report, the investigation found that 2,585,481 records of current and former customers were exposed. This article relies solely on that report, and the figures quoted are the ones the company released.

An intrusion on 19 October, detected on 23 October

The unauthorised access began on 19 October and was detected four days later, on 23 October. The company then shut down the compromised servers and blocked their outbound communications. Sony Network Communications reported the incident to the Personal Information Protection Commission, Japan’s data protection authority. It is still investigating the cause and scope of the intrusion.

As of 27 October, neither Sony Network Communications nor NTT Docomo had detected any fraudulent use of the exposed data.

The data involved

According to the company, the exposed records contain:

• full name, phone number and email address;
• user ID and internet connection ID;
• date of birth and gender.

The records contain no bank details, payment card numbers or other account data.

A second set of data is more sensitive: 54,401 email addresses, linked to several email services, were exposed together with the password for each account.

Of the total, 2,141,986 records relate to So-net customers and 443,495 to plala (S Course) customers. The plala customers belong to NTT Docomo, which uses Sony Network Communications to provide its Docomo Hikari service. Docomo has told its customers that the incident affects all current Hikari customers, as well as those who cancelled within the previous six months.

What subscribers should do

If your email address is one of the 54,401 exposed with a password, the company recommends that you change that password.

NTT Docomo has also warned its customers about phishing emails and fake websites posing as its d POINT Club programme and as a Universal Studios Japan (USJ) promotion. These messages tell you that you have won tickets and ask for your personal information so that you can claim them.

The exposed data (name, phone number, email address and date of birth) can be used to make a fraudulent message look personalised. Do not enter your personal information in response to an email saying you have won a prize. Such an email matches the pattern Docomo described, even if it uses your name.

A series of incidents in Japan

This breach comes after several Japanese companies and service providers have been hit by cyberattacks since the start of the year. GMO Internet Group suffered a malware attack that affected the customer servers of its Onamae Desktop Cloud service. The operator KDDI suffered a breach affecting 12 million customers, and IDC Frontier was hit by ransomware. In early 2025, attackers had already broken into NTT’s systems and stolen data on 18,000 corporate customers.

According to Bleeping Computer, the pace of these incidents led the Japanese government to hold emergency meetings on Monday to prepare its response.

So-net’s servers have been offline since 23 October. For the 2.5 million subscribers affected, the risk now comes from messages that could use their name, phone number and date of birth to reach them.